PT-2014-6126 · Ibm · Ibm Security Appscan Enterprise

Published 2014-08-29 · Updated 2021-06-11 · CVE-2014-4806

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions 8.x through 8.6.0.2 iFix 002 IBM Security AppScan Enterprise versions 8.7.x through 8.7.0.1 iFix 002 IBM Security AppScan Enterprise versions 8.8.x through 8.8.0.1 iFix 001 IBM Security AppScan Enterprise versions 9.0.x through 9.0.0.1

Description The installation process in IBM Security AppScan Enterprise on Linux places a cleartext password in a temporary file. This allows local users to obtain sensitive information by reading this file.

Recommendations For versions 8.x through 8.6.0.2 iFix 002, update to 8.6.0.2 iFix 003 or later. For versions 8.7.x through 8.7.0.1 iFix 002, update to 8.7.0.1 iFix 003 or later. For versions 8.8.x through 8.8.0.1 iFix 001, update to 8.8.0.1 iFix 002 or later. For versions 9.0.x through 9.0.0.1, update to 9.0.0.1 iFix 001 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2014-4806

Affected Products

Ibm Security Appscan Enterprise

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/95354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4806 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21682642 · Note
• http://securityfocus.com/bid/69435 · Note
• https://t.me/cvenotify/15823 · Telegram Post